Skip to content
Liquid Network Hack: $320 Million in Bitcoin Withdrawn by Purported White-Hat Hackers

Liquid Network Hack: $320 Million in Bitcoin Withdrawn by Purported White-Hat Hackers

First seen 7 Sep 2026, 09:23 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 8, 2026 at 09:04 UTC
  • •Approximately 4,000 BTC worth $320 million were withdrawn from Liquid Network's wallet.
  • •The hackers exploited a vulnerability in the Elements software, not through compromised keys.
  • •Liquid Network has paused all transactions and is in communication with the hackers regarding fund return.

On September 6, 2026, approximately 4,000 BTC, valued at around $320 million, were withdrawn from the Liquid Network's federation wallet by unidentified actors claiming to be white-hat hackers. The withdrawal represented about 95% of the network's total reserves, which were approximately 4,200 BTC prior to the incident. The hackers exploited a vulnerability in the Elements software, allowing them to create L-BTC that was not backed by actual Bitcoin. Liquid Network has since paused transactions and disabled bridge nodes while investigating the incident. Communication between the hackers and Blockstream, the network's provider, has occurred via on-chain messages, with the hackers stating they would return 'most' of the stolen funds if the vulnerability is fixed. The situation raises significant concerns regarding the security of crypto infrastructure. As of now, the funds remain under the hackers' control, and there is no guarantee of their return.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 47d ago How this analysis works

Timeline

2026-09-06
4,000 BTC withdrawn from Liquid Network
Purported white-hat hackers withdrew approximately 4,000 BTC, representing 95% of the network's reserves, exploiting a vulnerability in the Elements software.
Bitcoinmagazine
2026-09-06
Liquid Network pauses transactions
Following the withdrawal, Liquid Network disabled bridge nodes and paused all transactions to investigate the security incident.
Decrypt.Co
2026-09-07
Communication established with hackers
Blockstream began communicating with the hackers through on-chain messages, discussing the potential return of the stolen funds contingent on fixing the vulnerability.
Thecyberexpress

More articles in this cluster (26)

Following this threat?

Track Blockstream in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed